Ghaida Mubarak
cybersecurity engineer
Riyadh
Cybersecurity Engineer specializing in digital forensics, malware analysis, application security, and enterprise cybersecurity. Extensive experience includes delivering cybersecurity initiatives across government environments in Saudi Arabia, covering Data Loss Prevention (DLP), Information Rights Management (IRM), vulnerability management, and secure enterprise mobility. Research focuses on applying artificial intelligence to digital forensics and resulted in the published paper A Framework to Analyze OS Systems Artifacts from Linux Machines, introducing an automated deep learning framework for Linux memory forensics. Holds a Master's degree in Cybersecurity and Digital Forensics and the Offensive Security Certified Professional (OSCP) certification.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Cybersecurity and Digital Forensic
Linux powers critical enterprise systems, but when a Linux server is compromised, memory investigation is often manual, slow, and difficult to scale. This session presents an automated deep learning framework for analyzing Linux memory artifacts in controlled, on-premises virtual machine environments.The framework begins by collecting Linux ELF malware samples through the Malware Bazaar API and benign samples from trusted open-source repositories. Each sample is executed inside an isolated Debian virtual machine managed with VirtualBox and Vagrant. Before and after execution, the framework captures the VM�s memory state, restores the machine to a clean snapshot, and prepares it for the next sample.To reduce memory size and unnecessary data exposure, SHA-256 page-level deduplication removes pages identical to the clean baseline. The remaining memory data is transformed into high-resolution RGB images. Color histograms and texture descriptors reveal visual differences between benign and malicious memory patterns.These images are then resized, normalized, and classified using ResNet-50. The framework achieved a 98.75% malware detection rate and approximately 89% accuracy when classifying malware families, significantly outperforming a simpler sequential CNN model.Attendees will learn how malware collection, VM automation, memory acquisition, deduplication, image transformation, and deep learning can be combined into a repeatable Linux forensic pipeline. The session also addresses practical limitations, including model interpretability, privacy, resource requirements, encrypted memory, and the future integration of real-time memory analysis.
- 12:30
- Wed
- 02 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote